TryHackMe · 2026-07-02 · 3 min read
Warzone 1
TryHackMe SOC triage room investigating an IDS alert with Brim, Wireshark, NetworkMiner, and VirusTotal to confirm malware command and control activity.
CTF Room: Warzone 1
- Link to room
- Difficulty: Medium
- Category: SOC, PCAP Analysis, Malware Traffic Analysis
- OS: Windows
1. Brief
Warzone 1 is a TryHackMe SOC triage room. The scenario starts with an IDS/IPS alert for potentially bad traffic and malware command and control activity.
The goal was to inspect the PCAP, confirm whether the alert was a true positive, and pull out the useful artefacts.
Tools used:
- Brim
- Wireshark
- NetworkMiner
- VirusTotal
- CyberChef for defanging
2. Alert Triage
What was the alert signature for Malware Command and Control Activity Detected?
I loaded the PCAP into Brim and searched for the malware command and control alert. Keeping it simple worked here: search the alert wording and check the signature field.
Answer
What is the source IP address?
The alert showed the internal source host.
Answer
What IP address was the destination IP in the alert?
The same alert showed the external destination.
Answer
3. VirusTotal Enrichment
Under Community, what threat group is attributed to this IP address?
I searched the flagged destination IP in VirusTotal and checked the Community tab. The IP was associated with a known threat group.
Answer
What is the malware family?
The alert and VT context both pointed to the same malware family.
Answer
What was the majority file type listed under Communicating Files?
Under VirusTotal's communicating files view, the majority type lined up with the installer payloads later recovered from the PCAP.
Answer
4. Web Traffic Review
Inspect the web traffic for the flagged IP address; what is the user-agent in the traffic?
In Wireshark, I filtered on the flagged IP and searched packet details for User-Agent.
Display filter
ip.addr == <flagged-ip>The HTTP traffic used a distinctive user-agent.
Answer
5. Retracing The Attack
There were multiple IP addresses associated with this attack. What were two other IP addresses?
Back in Brim, I filtered HTTP traffic and looked for unique source, destination, and user-agent combinations.
Brim query
_path == "http" | cut id.orig_h, id.resp_h, user_agent | uniqTwo more external IPs stood out because they shared the same suspicious installer activity.
Answer
What were the file names of the downloaded files?
I loaded the PCAP into NetworkMiner and checked the Files tab. Filtering by the two IPs from the previous question showed the MSI downloads.
Answer
6. Payload Paths
Inspect the traffic for the first downloaded file. What is the full file path of the directory and the name of the two files?
For the first MSI download, I went back into Wireshark, filtered by the relevant IP, and followed the HTTP stream. The stream exposed plaintext strings containing the file paths that would be saved on disk.
Answer
Inspect the traffic for the second downloaded file. What is the full file path of the directory and the name of the two files?
I repeated the same process for the second MSI download: filter by IP, follow the HTTP stream, and inspect the payload strings.
Answer
7. Summary
This alert was a true positive. Brim gave the initial IDS signature and traffic pivots, VirusTotal tied the infrastructure to the threat group and malware family, Wireshark exposed the user-agent and payload paths, and NetworkMiner made the downloaded MSI files easy to confirm.
The chain was clean: internal host to flagged C2, related MSI downloads from two more IPs, and file paths showing what those installers tried to place under C:\ProgramData.